Free SCS-C0x: AWS Certified Security - Specialty (version unresolved - unique questions from title pool) Exam Questions and Answers
4 verified practice questions for SCS-C0x.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Provider
- Amazon
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
- Practice format
- Multiple choice
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account. When the code is processed, the following error message appears: "An error oc-curred (AccessDenied) when calling the AssumeRole operation." Which combination of steps should the security engineer take to resolve this er-ror? (Select TWO.)
Select 2 answers.
Please select an optionIncorrectCorrect answer: A, C
Cross-account role assumption requires permissions on both sides: an identity policy on LambdaAuditRole allowing sts:AssumeRole for the target role ARN, and a trust policy on AcmeAuditFactoryRole naming LambdaAuditRole as a trusted principal.
Was this answer correct?Question #2
A company wants to deploy a distributed web application on a fleet of EC2 instances. The fleet will be fronted by a Classic Load Balancer that will be configured to terminate the TLS connection The company wants to make sure that all past and current TLS traffic to the Classic Load Balancer stays secure even if the certificate private key is leaked. To ensure the company meets these requirements, a Security Engineer can configure a Classic Load Balancer with:
Please select an optionIncorrectCorrect answer: B
this is a way to configure a Classic Load Balancer with perfect forward secrecy cipher suites. Perfect forward secrecy is a property of encryption protocols that ensures that past and current TLS traffic stays secure even if the certificate private key is leaked. Cipher suites are sets of algorithms that determine how encryption is performed. A custom security policy is a set of cipher suites and protocols that you can select for your load balancer to support. An HTTPS listener is a process that checks for connection requests using encrypted SSL/TLS protocol. By using an HTTPS listener that uses a custom security policy that allows only perfect forward secrecy cipher suites, you can ensure that your Classic Load Balancer meets the requirements. The other options are either invalid or insufficient for configuring a Classic Load Balancer with perfect forward secrecy cipher suites.
Was this answer correct?Question #3
An ecommerce website was down for 1 hour following a DDoS attack Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this9 (Select TWO )
Select 2 answers.
Please select an optionIncorrectCorrect answer: B, E
To minimize downtime in response to DDoS attacks, the company should do the following: Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack. This provides access to 24x7 support from the AWS DDoS Response Team (DRT), as well as advanced detection and mitigation capabilities for network and application layer attacks. Use AWS WAF to create rules to respond to such attacks. This allows the company to filter web requests based on IP addresses, headers, body, or URI strings, and block malicious requests before they reach the web applications.
Was this answer correct?Question #4
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts. The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan. What should the security engineer do next to meet the requirements in the MOST secure way?
Please select an optionIncorrectCorrect answer: A
The correct answer is A. Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Share the portfolio with the OU. According to the AWS documentation, AWS Service Catalog is a service that allows you to create and manage catalogs of IT services that are approved for use on AWS. You can use Service Catalog to centrally manage commonly deployed IT services and help achieve consistent governance and compliance requirements, while enabling users to quickly deploy only the approved IT services they need. To use Service Catalog with multiple AWS accounts, you need to enable AWS Organizations with all features enabled. This allows you to centrally manage your accounts and apply policies across your organization. You can also use Service Catalog as a service principal for AWS Organizations, which lets you share your portfolios with organizational units (OUs) or accounts in your organization. To create a Service Catalog portfolio, you need to use an administrator account, such as the organization’s management account. You can upload your CloudFormation template as a product in your portfolio, and define constraints and tags for it. You can then share your portfolio with the OU that contains the accounts for the web applications. This will allow the developers in those accounts to launch products from the shared portfolio using the Service Catalog end user console. Option B is incorrect because CloudFormation modules are reusable components that encapsulate one or more resources and their configurations. They are not meant to be used as templates for deploying entire stacks of resources. Moreover, sharing a module with an OU does not grant access to launch stacks from it. Option C is incorrect because creating an IAM role that has a trust policy that allows cross-account access to the portfolio is not secure. It would allow any user in the OU accounts to assume the role and access the portfolio, regardless of their job function or access requirements. Option D is incorrect because sharing a module with an OU does not grant access to launch stacks from it. It also does not limit access to the deployment plan to only the developers who need access.
Was this answer correct?
Other Amazon certifications
- AWS Certified Cloud Practitioner CLF-C02 (opens in a new tab)
- AWS Certified Developer Associate (opens in a new tab)
- AWS Certified Security - Specialty (opens in a new tab)
- AWS Certified Solutions Architect - Associate SAA-C03 (opens in a new tab)
- AWS Certified Cloud Practitioner (CLF-C01) (opens in a new tab)
- AWS Certified Security - Specialty SCS-C02 (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://aws.amazon.com/certification/
- Q1: What are Amazon Certification Exams?
- A: Amazon Certification Exams validate your expertise in Amazon Web Services (AWS), covering a range of cloud computing skills, including architecture, development, operations, and data analytics. These certifications demonstrate your proficiency in designing, deploying, and managing applications on the AWS platform.
- Q2: Why should I pursue Amazon Certification?
- A: Amazon Certification enhances your professional credibility, showcasing your skills and knowledge in AWS services. This can lead to better job opportunities, higher salaries, and career advancement in the cloud computing and IT industry.
- Q3: What are the benefits of Amazon Certification?
- A: Benefits include recognition as a certified cloud professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest AWS technologies and best practices.
- Q4: Who should take Amazon Certification Exams?
- A: IT professionals, cloud architects, developers, system administrators, data analysts, and anyone involved in designing, implementing, and managing cloud solutions on AWS should consider these certifications to validate their expertise and advance their careers.
- Q5: What types of Amazon Certification Exams are available?
- A: Amazon offers various certification paths, including Foundational Level (AWS Certified Cloud Practitioner), Associate Level (AWS Certified Solutions Architect, AWS Certified Developer, AWS Certified SysOps Administrator), Professional Level (AWS Certified Solutions Architect – Professional, AWS Certified DevOps Engineer – Professional), and Specialty Certifications (Security, Big Data, Advanced Networking, and more).
- Q6: How do I prepare for Amazon Certification Exams?
- A: Preparation can include official AWS training courses, study guides, practice exams, online tutorials, and hands-on experience with AWS services and solutions.
- Q7: Where can I take Amazon Certification Exams?
- A: Amazon Certification Exams can be taken online or at authorized testing centers worldwide, providing flexibility to fit your schedule and location.
- Q8: How do Amazon Certifications impact my career?
- A: Amazon Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in the cloud computing and IT industry.
- Q9: Are there any prerequisites for Amazon Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior certifications. Check the specific requirements for each certification path on the AWS Certification website.
- Q10: How often do I need to recertify for Amazon Certifications?
- A: AWS Certifications typically require recertification every three years to ensure that certified professionals stay updated with the latest AWS technologies and industry practices.